diff options
| author | Long Li <longli@microsoft.com> | 2017-08-29 02:43:59 +0200 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2017-08-31 03:53:13 +0200 |
| commit | 0208eeaa650c5c866a3242201678a19e6dc4a14e (patch) | |
| tree | ae5fe7c51c5da9a9604b8cee632e88c0b6567b4b /drivers/scsi/storvsc_drv.c | |
| parent | scsi: aacraid: Fix command send race condition (diff) | |
| download | linux-0208eeaa650c5c866a3242201678a19e6dc4a14e.tar.xz linux-0208eeaa650c5c866a3242201678a19e6dc4a14e.zip | |
scsi: storvsc: fix memory leak on ring buffer busy
When storvsc is sending I/O to Hyper-v, it may allocate a bigger buffer
descriptor for large data payload that can't fit into a pre-allocated
buffer descriptor. This bigger buffer is freed on return path.
If I/O request to Hyper-v fails due to ring buffer busy, the storvsc
allocated buffer descriptor should also be freed.
[mkp: applied by hand]
Fixes: be0cf6ca301c ("scsi: storvsc: Set the tablesize based on the information given by the host")
Cc: <stable@vger.kernel.org>
Signed-off-by: Long Li <longli@microsoft.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/storvsc_drv.c')
| -rw-r--r-- | drivers/scsi/storvsc_drv.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 3cc8d67783a1..5e7200f05873 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1640,6 +1640,8 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) put_cpu(); if (ret == -EAGAIN) { + if (payload_sz > sizeof(cmd_request->mpb)) + kfree(payload); /* no more space */ return SCSI_MLQUEUE_DEVICE_BUSY; } |